Binance resumes withdrawals after covering 95% of $6.3 billion hack losses

Binance resumed phased cryptocurrency withdrawals on November 1, 2026, after covering 95% of the $6.3 billion stolen in the largest digital heist on record. The exchange deployed its $1 billion SAFU reserve, corporate treasury, and insurance funds to buy replacement tokens and reimburse 335 million registered users. While the FBI and blockchain security firms attributed the attack to North Korea's TraderTraitor unit, President Donald Trump noted U.S. uncertainty. Partner exchanges froze $3 billion of the stolen funds.

Withdrawal halting and resumption

• ▪Binance halted cryptocurrency withdrawals following an October 29-30, 2026 security breach that drained $6.3 billion from its hot wallets, marking the largest crypto heist on record
• ▪Binance initiated phase one of withdrawal resumptions following its $6.3 billion hack at 06:00 UTC on November 1, 2026, restoring access for 15 cryptocurrency networks including Bitcoin, Ether, XRP, and Dogecoin based on user demand data

Reimbursement of stolen funds

• ▪Binance set aside over $6.3 billion in internal funds to purchase replacement tokens for assets stolen in its hack through market and over-the-counter channels, covering 95% of customer losses by November 1, 2026
• ▪Binance Co-CEO Yi He said Binance funded stolen token replacements using its corporate treasury, Futures Insurance Fund, and 50% of its Secure Asset Fund for Users (SAFU), committing to replenish SAFU to $1 billion
• ▪Binance co-CEO Richard Teng stated on October 30, 2026 that the exchange could cover security breach losses due to its ongoing investment of revenue into cryptocurrencies
• ▪Binance stated that the remaining 5% of unbacked assets stolen in its $6.3 billion hack consist of less liquid tokens that require additional time to source in required volumes

Proof of asset backing

• ▪Binance scheduled a zero-knowledge proof-of-reserves audit for November 2026 to allow users holding fully backed tokens to verify 1:1 asset backing
• ▪Binance confirmed on October 31, 2026 that 10 major crypto assets including Bitcoin, Ether, USDT, BNB, USDC, and XRP were fully backed at 100%

Details of the security breach

• ▪TRM Labs and Chainalysis reported that the bulk of the $6.3 billion Binance cyberattack unfolded in approximately 20 minutes late on October 29, 2026
• ▪Binance co-CEO Richard Teng stated that the $6.3 billion October 2026 security breach involved a compromised software engineer's laptop and malicious software engineered to erase activity logs

Freezing of stolen assets

• ▪Binance collaborated with industry partners to freeze approximately $3 billion of the $6.3 billion in assets stolen during its October 2026 hack across partner platforms as of October 30, 2026
• ▪Dragonfly managing partner Haseeb Qureshi described the rapid industry response and asset freezing following the $6.3 billion October 2026 Binance attack as a sign of cryptocurrency market maturity

Attribution of the attack

• ▪U.S. President Donald Trump stated on October 31, 2026 that the United States government remained uncertain whether North Korea was responsible for the $6.3 billion Binance cyber heist
• ▪The FBI and blockchain analytics firms TRM Labs, Chainalysis, and Elliptic linked the $6.3 billion Binance cyberattack that occurred in late October 2026 to the North Korean state-sponsored hacking unit TraderTraitor
• ▪The FBI reported that TraderTraitor attackers were observed converting stolen Binance assets into Ether, warning of expected further laundering of those assets